[Bug analyzer/108100] New: GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) "

[Bug analyzer/108100] New: GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) "

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108100

            Bug ID: 108100
           Summary: GCC Static Analyzer does not know "(a || b) == true"
                    in the true branch of "if (a || b) "
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

I found a problem that GCC static analyzer does not know "(a||b) == true" in
the true branch of "if (a || b) "，and takes the 'true' branch of `if (!a)` and
the 'true' branch of `if (!b)` at the same time  (which is contradictory),
resulting in the wrong report of NPD warning. 
I think GCC Static Analyer may not handle '||' operator well. Please take a
look.

I run gcc (trunk) with options `-fanalyzer -O0`
https://godbolt.org/z/4Y41j1GfW

Input:
```c
#include <stdbool.h>

int foo(bool a, bool b) {
    int *c = 0;
    int *d = 0;
    if (a || b){
        __analyzer_eval(a);
        __analyzer_eval(b);
        __analyzer_eval(a||b);
        __analyzer_eval((a||b) == true);

        if (!a){
            if (!b){
                __analyzer_eval(a||b);
                *d = 0;
            }
        }
    }
}

```
Output:
```bash
<source>: In function 'foo':
<source>:7:9: warning: implicit declaration of function '__analyzer_eval'
[-Wimplicit-function-declaration]
    7 |         __analyzer_eval(a);
      |         ^~~~~~~~~~~~~~~
<source>:7:9: warning: UNKNOWN
    7 |         __analyzer_eval(a);
      |         ^~~~~~~~~~~~~~~~~~
<source>:8:9: warning: UNKNOWN
    8 |         __analyzer_eval(b);
      |         ^~~~~~~~~~~~~~~~~~
<source>:9:9: warning: UNKNOWN
    9 |         __analyzer_eval(a||b);
      |         ^~~~~~~~~~~~~~~~~~~~~
<source>:10:9: warning: UNKNOWN
   10 |         __analyzer_eval((a||b) == true);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:14:17: warning: UNKNOWN
   14 |                 __analyzer_eval(a||b);
      |                 ^~~~~~~~~~~~~~~~~~~~~
<source>:15:20: warning: dereference of NULL 'd' [CWE-476]
[-Wanalyzer-null-dereference]
   15 |                 *d = 0;
      |                 ~~~^~~
  'foo': events 1-7
    |
    |    4 |     int *c = 0;
    |      |          ^
    |      |          |
    |      |          (1) 'c' is NULL
    |    5 |     int *d = 0;
    |      |          ~
    |      |          |
    |      |          (2) 'c' is NULL
    |......
    |   12 |         if (!a){
    |      |            ~
    |      |            |
    |      |            (3) following 'true' branch...
    |   13 |             if (!b){
    |      |                ~~~
    |      |                ||
    |      |                |(4) ...to here
    |      |                (5) following 'true' branch...
    |   14 |                 __analyzer_eval(a||b);
    |      |                 ~~~~~~~~~~~~~~~~~~~~~
    |      |                 |
    |      |                 (6) ...to here
    |   15 |                 *d = 0;
    |      |                 ~~~~~~
    |      |                    |
    |      |                    (7) dereference of NULL 'd'
    |
Compiler returned: 0
```

[Bug analyzer/108100] GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) "

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108100

--- Comment #1 from Geoffrey <geoffreydgr at icloud dot com> ---
Hi, David. Could you spare some time to explain why GSA cannot handle `||`?
Will you fix this? I'd like to contribute. Thanks a lot!